Arkon version 0.9.2 contains a broken access control flaw that allows an authenticated employee to read and modify data belonging to other departments. The vulnerability is due to routes in app/routers/sources.py that skip the can_access_document check, enabling attackers to call plan, progress, PATCH, retry, and approve-extraction endpoints with foreign source IDs. This can disclose derived wiki titles and summaries and alter ingestion state, potentially compromising confidentiality and integrity of departmental data.

The affected product is Arkon 0.9.2 from the vendor nduckmink. No other product versions are listed in the CVE data.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated employees and the attack vector is inferred to be inside the organization’s network, as the routes require an authenticated session. Given the lack of exploitation reports and the need for legitimate credentials, the risk is moderate but not negligible.